I am not sure which ports are open at boot process.
Ports 23, 80 are open when camera is completely up.
I tried both "juantech" and "helpme" as password. not working.
I tried these common telnet password that can be found on the net. (using hydra)
Code:
root:xc3511
root:vizxv
root:admin
admin:admin
root:888888
root:xmhdipc
root:default
root:juantech
root:123456
root:54321
support:support
root:
admin:password
root:root
root:12345
user:user
admin:
root:pass
admin:admin1234
root:1111
admin:smcadmin
admin:1111
root:666666
root:password
root:1234
root:klv123
Administrator:admin
service:service
supervisor:supervisor
guest:guest
guest:12345
guest:12345
admin1:password
administrator:1234
666666:666666
888888:888888
ubnt:ubnt
root:klv1234
root:Zte521
root:hi3518
root:jvbzd
root:anko
root:zlxx.
root:7ujMko0vizxv
root:7ujMko0admin
root:system
root:ikwb
root:dreambox
root:user
root:realtek
root:00000000
admin:1111111
admin:1234
admin:12345
admin:54321
admin:123456
admin:7ujMko0admin
admin:1234
admin:pass
admin:meinsm
tech:tech
Optimistic I know - without knowing what the firmware is
ONVIF Device Managershows this information about camera
I monitored packets recieving from camera by wireshark.
phase 1: (16 seconds after connecting power) first 3 packets are ARP request like this:
Code:
Frame 12: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: PolarisC_18:01:65 (00:10:85:18:01:65), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: PolarisC_18:01:65 (00:10:85:18:01:65)
Type: ARP (0x0806)
Padding: 000000000000000000000000000000000000
Address Resolution Protocol (request)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: PolarisC_18:01:65 (00:10:85:18:01:65)
Sender IP address: 192.168.1.168
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 192.168.1.169
Camera is searching for 192.168.1.169 (may be like dahua and hikvision, is looking for
tftp server?)
phase 2: (at 23 seconds after connecting power)
camera runs as usual with given IP. searching for 192.168.1.1
but this time with different MAC
Code:
Frame 270: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1516282698.184227000 seconds
[Time delta from previous captured frame: 0.383103000 seconds]
[Time delta from previous displayed frame: 0.383103000 seconds]
[Time since reference or first frame: 23.163712000 seconds]
Frame Number: 270
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: 00:9a:15:d6:f4:ff (00:9a:15:d6:f4:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: 00:9a:15:d6:f4:ff (00:9a:15:d6:f4:ff)
Type: ARP (0x0806)
Padding: 000000000000000000000000000000000000
Address Resolution Protocol (request)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: 00:9a:15:d6:f4:ff (00:9a:15:d6:f4:ff)
Sender IP address: 192.168.1.119
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 192.168.1.1
is there a tftp instruction about this type of chinese cameras?